TrustList daily digest · Tech and security

Saturday, 24 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security5

1Security advisories
Brotli fixes a critical decoder flaw that reaches far beyond Node.js
CVE-2026-111497 is rated 9.2 by Google and hits every Brotli release from 1.0.3 to 1.2.0. Envoy, the PyPI packages and Debian have shipped fixes; Ubuntu still ranks it medium.
2Security advisories
OpenJDK October update fixes 46 CVEs; Corretto builds are out
The quarterly advisory covers Java 8 to 27, with a top score of 7.0, and a separate notice adds the 9.1-rated TLS flaw CVE-2026-91403. Amazon Corretto shipped 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33 and 8u512.
3Security advisories
Pillow 13.0.0 closes 39 more flaws, two of them rated critical
Besides the bundled OpenJPEG overflow, the Python imaging library published 39 more advisories fixed in 13.0.0, including code execution from one crafted FlashPix file. One Arrow memory leak is still unfixed.
4Security advisories
Unbound 1.26.2 fixes a DNS-over-QUIC crash and two DNSSEC bypasses
NLnet Labs fixed five CVEs in its recursive resolver five weeks after the September release that patched a critical one, so servers still on 1.26.1 are behind again. Debian shipped DSA-6581-1.
5Security advisories
AWS will not fix two flaws in its retired Multi Model Server
CVE-2026-115812 and CVE-2026-115813 affect every MMS release up to 1.1.11, and the management API that exposes them has no authentication. AWS advises moving to a supported model server.

TrustList Weekly

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.